rust/lib/lsp-server/Cargo.toml

[package]
name = "lsp-server"
version = "0.7.3"
description = "Generic LSP server scaffold."
license = "MIT OR Apache-2.0"
repository = "https://github.com/rust-lang/rust-analyzer/tree/master/lib/lsp-server"
edition = "2021"

[dependencies]
log = "0.4.17"
serde_json = "1.0.96"
# See https://github.com/serde-rs/serde/issues/2538#issuecomment-1684517372 for why we pin serde
serde = { version = "1.0.156, < 1.0.172", features = ["derive"] }
crossbeam-channel = "0.5.6"

[dev-dependencies]
lsp-types = "=0.94"
internal: vendor lsp-server 2022-05-14 05:33:48 -05:00			`[package]`
			`name = "lsp-server"`
fix: avoid problematic serde release serde 1.0.172 and up rely on opaque non-reproducible binary blobs to function, explicitly not providing a library-level opt-out. This is problematic for two reasons: - directly, unauditable binary blobs are a security issue. - indirectly, it becomes much harder to predict future behaviors of the crate. As such, I am willing to go on a limb here and forbid building rust-analyzer with those versions of serde. Normally, my philosophy is to defer the choice to the end user, but it's also a design constraint of rust-analyzer that we don't run random binaries downloaded from the internet without explicit user's concent. Concretely, this upper-bounds serde for both rust-analyzer workspace, as well as the lsp-server lib. See https://github.com/serde-rs/serde/issues/2538 for wider context. 2023-08-19 07:41:13 -05:00			`version = "0.7.3"`
internal: vendor lsp-server 2022-05-14 05:33:48 -05:00			`description = "Generic LSP server scaffold."`
			`license = "MIT OR Apache-2.0"`
Update remaining GitHub URLs 2022-07-08 08:44:49 -05:00			`repository = "https://github.com/rust-lang/rust-analyzer/tree/master/lib/lsp-server"`
internal: vendor lsp-server 2022-05-14 05:33:48 -05:00			`edition = "2021"`

			`[dependencies]`
internal: Bump Dependencies 2022-06-10 09:30:09 -05:00			`log = "0.4.17"`
Disconnect library crate dependencies from workspace dependencies 2023-06-22 04:50:52 -05:00			`serde_json = "1.0.96"`
fix: avoid problematic serde release serde 1.0.172 and up rely on opaque non-reproducible binary blobs to function, explicitly not providing a library-level opt-out. This is problematic for two reasons: - directly, unauditable binary blobs are a security issue. - indirectly, it becomes much harder to predict future behaviors of the crate. As such, I am willing to go on a limb here and forbid building rust-analyzer with those versions of serde. Normally, my philosophy is to defer the choice to the end user, but it's also a design constraint of rust-analyzer that we don't run random binaries downloaded from the internet without explicit user's concent. Concretely, this upper-bounds serde for both rust-analyzer workspace, as well as the lsp-server lib. See https://github.com/serde-rs/serde/issues/2538 for wider context. 2023-08-19 07:41:13 -05:00			`# See https://github.com/serde-rs/serde/issues/2538#issuecomment-1684517372 for why we pin serde`
			`serde = { version = "1.0.156, < 1.0.172", features = ["derive"] }`
Don't retry requests that have already been cancelled 2022-09-07 06:52:55 -05:00			`crossbeam-channel = "0.5.6"`
internal: vendor lsp-server 2022-05-14 05:33:48 -05:00
			`[dev-dependencies]`
Bump lsp-types 2023-02-14 07:59:50 -06:00			`lsp-types = "=0.94"`